EUVD-2026-107031

A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The...

CVE-2026-113744 Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow

A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The...

PT-2026-120346

Name of the Vulnerable Software and Affected Versions Tenda AC19 version 16.03.10.07 Description A stack-based buffer overflow exists in the httpd Web Management Service. The issue occurs within the formSetFirewallCfg function located in the /goform/SetFirewallCfg endpoint when processing the...

Tenda AC19 buffer error vulnerability

The Tenda AC19 running version 16.03.10.07 contains a buffer error vulnerability. This vulnerability stems from improper handling of the “firewallEn” parameter by the formSetFirewallCfg function within the file /goform/SetFirewallCfg in the httpd Web Management Service component. It may lead to a...

Linux Distros Unpatched Vulnerability : CVE-2026-88834

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build...

Security update for busybox

This update for busybox fixes the following issues: CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message bsc1282575. CVE-2026-88831: httpd silently fails open when IP deny...

SUSE-SU-2026:4773-1 Security update for busybox

This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message bsc1282575. - CVE-2026-88831: httpd silently fails open when IP...

Security update for busybox

This update for busybox fixes the following issues: CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message bsc1282575. CVE-2026-88831: httpd silently fails open when IP deny...

SUSE-SU-2026:4760-1 Security update for busybox

This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message bsc1282575. - CVE-2026-88831: httpd silently fails open when IP...

CentOS Linux 7.9 [CIQ] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc Multiple Vulnerabilities (ciqsa-2026_1643)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261643 advisory. This advisory aggregates security fixes for the httpd SRPM in CIQ CentOS Bridge 7.9. It addresses 6 CVEs: CVE-2025-58098, CVE-2026-44186, CVE-2026-34059...

CLSA-2026-1791487799 httpd: Fix of 2 CVEs

CVE-2026-63292: modvhostalias: stack buffer overflow when a single Host header segment exceeds HUGESTRINGLEN; reject the expansion...

CLSA-2026-1791875496 httpd: Fix of CVE-2026-63686

CVE-2026-63686: modxml2enc: NULL pointer dereference on charset conversion failure...

Fedora 43 : httpd (2026-d3cec01bde)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d3cec01bde advisory. This update includes httpd version 2.4.69 addressing various security issues, see https://downloads.apache.org/httpd/CHANGES2.4.69 for more...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

Astra Linux – Vulnerability in Subversion

Apache Subversion SVN’s “authz” feature prevents the display of “copyfrom” paths that should be hidden according to configured path-based authorization rules. When a node is copied from a protected location, users with access to the copy can see the “copyfrom” path of the original node. This also...

SUSE CVE-2026-88829

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim t...

UBUNTU-CVE-2026-88834

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...

Linux Distros Unpatched Vulnerability : CVE-2026-88829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the...

Critical Photon OS Security Update - PHSA-2026-4.0-1084

Updates of 'pcre2', 'httpd' packages of Photon OS have been released...

UBUNTU-CVE-2026-88829

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim t...